Google Fit Extraction: Location, Health and Fitness Data

We have updated Elcomsoft Cloud Explorer, our Google Account extraction tool, with Google Fit support. Google Fit synchronizes massive amounts of data with the user’s Google Account, storing activity-related information collected by all of the user’s devices in a single place. When extracting these data, we discovered massive amounts of location points stored alongside with information related to the user’s physical activities. Learn what is stored in Google Fit and how to extract it from the cloud!

👉 https://blog.elcomsoft.com/2020/02/google-fit-extraction-location-health-and-fitness-data/

by Oleg Afonin

#google #googlefit #android #dataextraction #mobileforensic #cloudsecurity

Full File System Acquisition of iPhone 11 and Xr/Xs with iOS 13

The popular unc0ver jailbreak has been updated to v4, and this quite a big deal. The newest update advertises support for the latest A12 and A13 devices running iOS 13 through 13.3. The current version of iOS is 13.3.1. None of the older versions (including iOS 13.3) are signed, but still there are a lot of A12/A12X/A13 devices floating around. Until now, file system and keychain extraction was a big problem. The newest unc0ver jailbreak makes it possible.

👉🏻 https://blog.elcomsoft.com/2020/02/full-file-system-acquisition-of-iphone-11-and-xr-xs-ios-13/

by Vladimir Katalov

#unc0ver #jailbreak #iPhone #iOS #dataextraction #mobileforensic

iPhone Acquisition Without a Jailbreak (iOS 11 and 12)

Elcomsoft iOS Forensic Toolkit can perform full file system acquisition and decrypt the keychain from non-jailbroken iPhone and iPad devices. The caveat: the device must be running iOS 11 or 12 (except iOS 12.3, 12.3.1 and 12.4.1), and you must use an Apple ID registered in Apple’s Developer Program.
In this article, I’ll explain the pros and contras of the new extraction method compared to traditional acquisition based on the jailbreak.

👉 https://blog.elcomsoft.com/2020/02/iphone-acquisition-without-a-jailbreak-ios-11-and-12/

by Oleg Afonin

#iphone #iOS #keychain #jailbreak #EIFT #mobileforensic #dataextraction #ElcomsoftAgent

iOS Forensic Toolkit 5.30: jailbreak-free extraction for multiple Apple devices

Elcomsoft iOS Forensic Toolkit 5.30 is updated to support forensically sound, jailbreak-free extraction of iPhone and iPad devices running iOS 11 through 12.4. The new extraction method is based on direct access to the file system, and does not require jailbreaking the device. Users of EIFT 5.30 can perform the full file system extraction and decrypt the keychain without the risks and footprint associated with third-party jailbreaks.

Supported devices range from the iPhone 5s all the way up to the iPhone Xr, Xs and Xs Max if they run any version of iOS from iOS 11 through iOS 12.4 (except iOS 12.3 and 12.3.1). Apple iPad devices running on the corresponding SoC are also supported.

👉 https://www.elcomsoft.com/news/734.html

#iphone #iOS #keychain #jailbreak #EIFT #mobileforensic #dataextraction #ElcomsoftAgent

Meet with us at Regional Digital and Cyber Investigation CPD Workshops in Bedfordshire Police HQ (covers Bedfordshire, Hertfordshire, Cambridgeshire, Norfolk, Suffolk and Kent forces) and learn more about New approaches and possibilities in data acquisition from iOS devices. 📲

This and other future events can be found here: https://www.elcomsoft.com/events.html

#jailbreak #unc0ver #iPhone #iOS #dataextraction #mobileforensic #eift #toolkit #ios #iPhone #privacy #security #digitalforensics #computercrime

iOS Low-Level Acquisition: How to Sideload the Extraction Agent

Regular or disposable Apple IDs can now be used to extract data from compatible iOS devices if you have a Mac. The use of a non-developer Apple ID carries certain risks and restrictions. In particular, one must “verify” the extraction agent on the target iPhone, which requires an active Internet connection. Learn how to verify the extraction agent signed with a regular or disposable Apple ID without the risk of receiving an accidental remote lock or remote erase command.

👉 https://blog.elcomsoft.com/2022/04/ios-low-level-acquisition-how-to-sideload-the-extraction-agent/

#ios #eift #mobileforensic #dfir #agent

Elcomsoft iOS Forensic Toolkit 8.0 brings forensically sound bootloader-based extraction for select iPhone & iPad models

Elcomsoft iOS Forensic Toolkit 8.0 is a major release bringing support for repeatable, verifiable, and truly forensically sound bootloader-level extraction of 76 Apple devices ranging from the ancient iPhone 4 all the way up to the iPhone X, a large number of iPad, iPod Touch, Apple Watch, and Apple TV models, and featuring a refreshed, command-line driven user interface.

👉 https://www.elcomsoft.com/news/822.html

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16

iOS 16: Extracting the File System and Keychain from A11 Devices

Bootloader-based acquisition is the only 100% forensically sound data extraction method for Apple devices. It is the only way to acquire the full set of data from those devices that run iOS 16, albeit with a huge caveat that makes the whole thing more of a brain exercise than a practical forensic tool. Let’s review the iOS 16 compatibility in iOS Forensic Toolkit and go through the whole process step by step.

👉 https://blog.elcomsoft.com/2022/09/ios-16-extracting-the-file-system-and-keychain-from-a11-devices/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain

iOS Forensic Toolkit 8.0 Now Official: Bootloader-Level Extraction for 76 Devices

iOS Forensic Toolkit 8.0 is officially released! Delivering forensically sound checkm8 extraction and a new command-line driven user experience, the new release becomes the most sophisticated mobile forensic tool we’ve released to date.

👉🏻 https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain

iOS 16: SEP Hardening, New Security Measures and Their Forensic Implications

iOS 16 brings many changes to mobile forensics. Users receive additional tools to control the sharing and protection of their personal information, while forensic experts will face tighter security measures. In this review, we’ll talk about the things in iOS 16 that are likely to affect the forensic workflow.

👉🏻 https://blog.elcomsoft.com/2022/09/ios-16-sep-hardening-new-security-measures-and-their-forensic-implications/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #checkm8

checkm8 extraction for iOS 15.7.6 and 16.5

Elcomsoft iOS Forensic Toolkit 8.23 expands bootloader-level checkm8-based extraction support, adding support for the latest available iOS 15 and 16 builds. The newly supported OS versions include iOS/iPadOS/tvOS 15.7.6 and 16.5. Thanks to the expanded range of supported OS versions, the tool now supports the full range of of iOS 15 and 16 builds on checkm8-vulnerable devices.

👉 https://www.elcomsoft.com/news/838.html

#EIFT #checkm8 #iOS #dfir #mobileforensic

Low-level extraction supported for last-gen iPhones with iOS 16

Elcomsoft iOS Forensic Toolkit 8.30 and 7.90 expand low-level extraction support, now covering iOS 16.0 through 16.3.1 on latest-generation iPhone and iPad models. For the first time ever, full file system extraction becomes available on the iPhone 14 and 14 Pro range of devices and other iPhone and iPad models built with the A12 and newer chips, effectively covering the iPhone Xr/Xs through iPhone 14/Pro range and many corresponding iPads including those based on Apple M1 and M2 chips.

👉 https://www.elcomsoft.com/news/839.html

#iphone #iOS #ipad #EIFT #mobileforensic #dataextraction #ElcomsoftAgent #agent